)]}'
{
  "commit": "2bb6cda4396835d09dcca2db6fc18463e837cdae",
  "tree": "f476d11a211b90243632773402662f99dea407fc",
  "parents": [
    "1d8d9c6acfc856fa553ebb46ab68060602843121"
  ],
  "author": {
    "name": "Ilya Chichkov",
    "email": "ilya.chichkov.dev@gmail.com",
    "time": "Fri Aug 14 17:21:59 2026 +0300"
  },
  "committer": {
    "name": "Michael Tokarev",
    "email": "mjt@tls.msk.ru",
    "time": "Thu Aug 20 19:42:06 2026 +0300"
  },
  "message": "accel/tcg: Allow overlapping reads in record_save\n\nrecord_save() assumed that a target reads the bytes of an insn as a\nstrictly ascending sequence of adjacent chunks, and asserted that each\nread begins exactly where the previous one ended.\n\nThat assumption no longer holds for riscv.  Since f9eaa1542b\n(\"target/riscv: support atomic instruction fetch (Ziccif)\"),\ndecode_opc() loads a full aligned word whenever pc is 4-byte aligned,\neven when the insn turns out to be a 2-byte compressed one, so the\nrecord may already hold bytes past the end of the insn being\ntranslated.  When such a compressed insn sits at page offset 0xffc,\npc_next becomes 0xffe, which is within MAX_INSN_LEN of the end of the\npage, and riscv_tr_translate_insn() probes the next insn to decide\nwhether it would cross the page boundary.  That probe reads at offset\n2 while the record already covers [0,4), and the assert fires:\n\n  qemu-system-riscv32: accel/tcg/translator.c:395: record_save:\n  Assertion `offset \u003d\u003d db-\u003erecord_start + db-\u003erecord_len\u0027 failed.\n\nrecord_save() is only reached when the insn is fetched from MMIO, so\nthis is visible on boards that execute code from a region created with\nmemory_region_init_io(), such as an XIP flash window mapped over a\nserial flash controller.\n\nBoth sides of the collision are correct: the wide fetch is required for\nZiccif atomicity, and the probe is required for correct fault reporting\nat a page boundary, per 00c07344fa (\"target/riscv: Make translator stop\nbefore the end of a page\").  Unlike a86d3352ab (\"target/riscv: do not\nuse translator_ldl in opcode_at\"), where a non-translation caller had\nno business using translator_ld*, the probe here is a genuine\ntranslation read whose bytes must be recorded.\n\nRelax the invariant instead.  Keep requiring that a read neither moves\nbackwards nor leaves a gap, but let a read overlapping the recorded\nrange extend it only by the bytes past its end.\n\nCc: qemu-stable@nongnu.org\nFixes: f9eaa1542b (\"target/riscv: support atomic instruction fetch (Ziccif)\")\nSigned-off-by: Ilya Chichkov \u003cilya.chichkov.dev@gmail.com\u003e\nReviewed-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\nMessage-ID: \u003c20260814142159.3800744-1-ilya.chichkov.dev@gmail.com\u003e\n(cherry picked from commit 784b7f28e2761fbd3c753883be949eb3d1ffe228)\nSigned-off-by: Michael Tokarev \u003cmjt@tls.msk.ru\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "f3eddcbb2e8a6cbaf27f81428fd8a20de1e0c027",
      "old_mode": 33188,
      "old_path": "accel/tcg/translator.c",
      "new_id": "179d74f96deb892f37e182b99d19d07bd5bee660",
      "new_mode": 33188,
      "new_path": "accel/tcg/translator.c"
    }
  ]
}